Cloud Migration Part 2: Classify your data

An image of a light shining through a tunnel.

Transformation Network

By pwsadmin | May 15, 2021

The Achilles heel of every transformative business model is their reliance on ever increasing amounts of data that need to be transported quickly across wide area networks and processed at…

A person holding up three frames in front of their face.

Essential Characteristics of Cloud Computing as Digital Transformation

By pwsadmin | May 15, 2021

Hybrid IT blends traditional datacenters, managed service providers, and cloud service providers to deliver the necessary mix of information technology services. This IT consumption model enables a composable infrastructure which…

A mosaic of hands and flowers on the wall.

Transformation Innovation

By pwsadmin | May 15, 2021

4 Factors Driving Digital Transformation ROI The critical assessment factors for cloud ROI risk probability are the following:      Infrastructure utilization Speed of migration to cloud Ability to scale business/mission processes…

A neon sign with a handshake on it.

Transformation Frameworks

By pwsadmin | May 15, 2021

Digital transformation necessitates changes in an organization’s operational processes. According to Harvard, a focus on operations can lead to business process optimization and entirely new revenue streams. Three common routes…

A group of people standing in a room with wires hanging from the ceiling.

Transformation Infrastructure

By pwsadmin | September 26, 2020

Hybrid IT enables a composable infrastructure which describes a framework whose physical compute, storage, and network fabric resources are treated as services. Resources are logically pooled so that administrators need…

A close up of the pattern on a solar panel.

Essential Characteristics of Cloud Computing as Digital Transformation

By pwsadmin | September 25, 2020

A survey of 2,000 executives conducted by Cognizant in 2016 identified the top five ways digital transformations generate value:      Accelerating speed to market      Strengthening competitive positioning      Boosting revenue growth      Raising…

A close up of the trees in the sky

Embrace Transformation

By pwsadmin | September 22, 2020

From a business perspective, differentiating business processes and quality customer service are central to overall success. Business leaders must therefore clearly identify and measure how information technology contributes to the…

An image of a person's eye in a computer screen.

Computer Vision Advances Zero-Defect Manufacturing

By pwsadmin | July 25, 2020

by Kevin L. Jackson Electronics manufacturers operate in a challenging environment. It’s hard enough to keep up with the ever-accelerating rate of change in the industry. Now customers want increasingly…

A blue bus driving down the street with people crossing it.

Real-Time Analytics Power the Roadway of the Future

By pwsadmin | July 25, 2020

By Kevin L. Jackson The complexities of citywide traffic are pushing the limits of existing transportation management systems. Outdated infrastructure is based on proprietary, single-purpose subsystems, making it costly to…

A businessman standing on top of a cliff with his arms raised.

Thriving on the Edge: Developing CSP Edge Computing Strategy

By pwsadmin | March 6, 2020

Communications Service Providers (CSPs) are facing significant business model challenges. Referred to generally as edge computing, the possibilities introduced by the blending of 5G networks and distributed cloud computing technologies are…

In my first post of this series, “Cloud migration part one: An overview,” I provided a high-level summary of how enterprises should migrate applications to the cloud. In this installment, the focus is on enterprise data and why your organization may need to review and reclassify its data before moving anything to the cloud.

Security evolves with cloud

Cloud computing has done more than change the way enterprises consume information technology. It’s also changing how organizations need to protect their data. Some may see this as an unintended consequence, but the headlong rush to save money by migrating applications to the cloud has uncovered long-hidden application security issues. This revelation is mostly due to the widespread adoption of “lift and shift” as a cloud migration strategy. Using this option typically precludes any modifications of the migrating application. It can also result in the elimination of essential data security controls and lead to grave data breaches.

Manage deployment

Today, the cloud has quickly become the preferred deployment environment for enterprise applications. This shift to using other people’s infrastructure has brought with it tremendous variability in the nature and quality of infrastructure-based data security controls. It is also forcing companies to shift away from infrastructure-centric security to data-centric information security models. Expanding international electronic commerce, ever tightening national data sovereignty laws and regional data protection and privacy regulations such as GDPR. These issues have combined to make many data classification schema untenable. Cloud Security Alliance and the International Information Systems Security Certification Consortium (ISC2) both suggest that corporate data may need to be classified across at least eight categories, namely:

  • Data type
  • Jurisdiction and other legal constraints
  • Context
  • Ownership
  • Contractual or business constraints
  • Trust levels and source of origin
  • Value, sensitivity and criticality
  • The obligation for retention and preservation

Classify data

Moving to classify data at this level means that one of the most important initial steps of any cloud computing migration must be a review and possible reclassification of all organizational data. By bypassing this step, newly migrated applications simply become data breaches in wait. At a minimum, an enterprise should:

  • Document all key business processes destined for cloud migration.
  • Identify all data types associated with each migrating business process.
  • Explicitly assign the role of process data owner.
  • Assign each process data owner the task of setting and documenting the minimum required security controls for each data type.

Update policies

After completing these steps, companies should review and update their IT governance process to reflect any required expansion of their corporate data classification model. These steps are also aligned with the ISO 27034-1 framework for implementing cloud application security. This standard explicitly takes a process approach to specifying, designing, developing, testing, implementing and maintaining security functions and controls in application systems. It defines application security not as the state of security of an application system but as a process to apply controls and measurements to applications in order to manage the risk of using them.

In part three of this series, I’ll discuss application screening and related industry best practices to help you determine:

  • The most appropriate target application deployment environment
  • Each application’s business value, key performance indicators and target return-on-investment
  • Each application’s migration readiness
  • The appropriate application migration strategy
Posted in

G C Network